diff options
Diffstat (limited to 'net/netfilter')
-rw-r--r-- | net/netfilter/nfnetlink_log.c | 5 | ||||
-rw-r--r-- | net/netfilter/xt_owner.c | 16 |
2 files changed, 11 insertions, 10 deletions
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c index 41e0105d382..38f9efd90e8 100644 --- a/net/netfilter/nfnetlink_log.c +++ b/net/netfilter/nfnetlink_log.c | |||
@@ -474,8 +474,9 @@ __build_packet_message(struct nfulnl_instance *inst, | |||
474 | if (skb->sk) { | 474 | if (skb->sk) { |
475 | read_lock_bh(&skb->sk->sk_callback_lock); | 475 | read_lock_bh(&skb->sk->sk_callback_lock); |
476 | if (skb->sk->sk_socket && skb->sk->sk_socket->file) { | 476 | if (skb->sk->sk_socket && skb->sk->sk_socket->file) { |
477 | __be32 uid = htonl(skb->sk->sk_socket->file->f_uid); | 477 | struct file *file = skb->sk->sk_socket->file; |
478 | __be32 gid = htonl(skb->sk->sk_socket->file->f_gid); | 478 | __be32 uid = htonl(file->f_cred->fsuid); |
479 | __be32 gid = htonl(file->f_cred->fsgid); | ||
479 | /* need to unlock here since NLA_PUT may goto */ | 480 | /* need to unlock here since NLA_PUT may goto */ |
480 | read_unlock_bh(&skb->sk->sk_callback_lock); | 481 | read_unlock_bh(&skb->sk->sk_callback_lock); |
481 | NLA_PUT_BE32(inst->skb, NFULA_UID, uid); | 482 | NLA_PUT_BE32(inst->skb, NFULA_UID, uid); |
diff --git a/net/netfilter/xt_owner.c b/net/netfilter/xt_owner.c index f19ebd9b78f..22b2a5e881e 100644 --- a/net/netfilter/xt_owner.c +++ b/net/netfilter/xt_owner.c | |||
@@ -34,12 +34,12 @@ owner_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par) | |||
34 | return false; | 34 | return false; |
35 | 35 | ||
36 | if (info->match & IPT_OWNER_UID) | 36 | if (info->match & IPT_OWNER_UID) |
37 | if ((filp->f_uid != info->uid) ^ | 37 | if ((filp->f_cred->fsuid != info->uid) ^ |
38 | !!(info->invert & IPT_OWNER_UID)) | 38 | !!(info->invert & IPT_OWNER_UID)) |
39 | return false; | 39 | return false; |
40 | 40 | ||
41 | if (info->match & IPT_OWNER_GID) | 41 | if (info->match & IPT_OWNER_GID) |
42 | if ((filp->f_gid != info->gid) ^ | 42 | if ((filp->f_cred->fsgid != info->gid) ^ |
43 | !!(info->invert & IPT_OWNER_GID)) | 43 | !!(info->invert & IPT_OWNER_GID)) |
44 | return false; | 44 | return false; |
45 | 45 | ||
@@ -60,12 +60,12 @@ owner_mt6_v0(const struct sk_buff *skb, const struct xt_match_param *par) | |||
60 | return false; | 60 | return false; |
61 | 61 | ||
62 | if (info->match & IP6T_OWNER_UID) | 62 | if (info->match & IP6T_OWNER_UID) |
63 | if ((filp->f_uid != info->uid) ^ | 63 | if ((filp->f_cred->fsuid != info->uid) ^ |
64 | !!(info->invert & IP6T_OWNER_UID)) | 64 | !!(info->invert & IP6T_OWNER_UID)) |
65 | return false; | 65 | return false; |
66 | 66 | ||
67 | if (info->match & IP6T_OWNER_GID) | 67 | if (info->match & IP6T_OWNER_GID) |
68 | if ((filp->f_gid != info->gid) ^ | 68 | if ((filp->f_cred->fsgid != info->gid) ^ |
69 | !!(info->invert & IP6T_OWNER_GID)) | 69 | !!(info->invert & IP6T_OWNER_GID)) |
70 | return false; | 70 | return false; |
71 | 71 | ||
@@ -93,14 +93,14 @@ owner_mt(const struct sk_buff *skb, const struct xt_match_param *par) | |||
93 | (XT_OWNER_UID | XT_OWNER_GID)) == 0; | 93 | (XT_OWNER_UID | XT_OWNER_GID)) == 0; |
94 | 94 | ||
95 | if (info->match & XT_OWNER_UID) | 95 | if (info->match & XT_OWNER_UID) |
96 | if ((filp->f_uid >= info->uid_min && | 96 | if ((filp->f_cred->fsuid >= info->uid_min && |
97 | filp->f_uid <= info->uid_max) ^ | 97 | filp->f_cred->fsuid <= info->uid_max) ^ |
98 | !(info->invert & XT_OWNER_UID)) | 98 | !(info->invert & XT_OWNER_UID)) |
99 | return false; | 99 | return false; |
100 | 100 | ||
101 | if (info->match & XT_OWNER_GID) | 101 | if (info->match & XT_OWNER_GID) |
102 | if ((filp->f_gid >= info->gid_min && | 102 | if ((filp->f_cred->fsgid >= info->gid_min && |
103 | filp->f_gid <= info->gid_max) ^ | 103 | filp->f_cred->fsgid <= info->gid_max) ^ |
104 | !(info->invert & XT_OWNER_GID)) | 104 | !(info->invert & XT_OWNER_GID)) |
105 | return false; | 105 | return false; |
106 | 106 | ||